URL (Uniform Resource Locator) security analysis method and device for end-side large language model and medium

Abstract

The invention discloses a URL (Uniform Resource Locator) security analysis method and device for an end-side large language model and a medium, and belongs to the field of network and information security. The method comprises the steps of collecting multi-modal data such as a URL analysis structure, DNS / certificate metadata, front-end code sampling, an OCR text and a dynamic behavior event sequence; performing exponential decay weighted aggregation on the dynamic events in the sliding time window; generating a static structure feature, a text semantic feature and a threat intelligence similarity based on the multi-modal data; fusing the multi-modal features by adopting a gating attention mechanism; inputting the fusion features and the readable context into an end-side large language model, and calling a security analysis tool set under limited decoding; a risk score and a minimum sufficient evidence are obtained through two-stage scoring; and executing an end-side security policy according to the scoring threshold value and leaving a trace by using a JSONL structure. According to the method, in-end closed-loop analysis is realized, the detection accuracy is remarkably improved, and the method is suitable for various deployment scenes such as mobile terminals and edge gateways.

Description

Technical Field

[0001] This invention relates to the field of network and information security, specifically to a method, apparatus, and medium for URL security analysis of a large language model on the endpoint. Background Technology

[0002] URL, short for Uniform Resource Locator, is the address of a resource on the Internet. End-to-end Large Language Model (LLM) URL security analysis refers to deploying a lightweight large language model on terminal devices to directly perform security analysis on URLs and related web page content.

[0003] Existing URL security detection technologies mainly rely on blacklist / whitelist matching, rule-based detection methods, or cloud sandbox analysis. These methods have significant shortcomings in dealing with increasingly complex cyber threats. 1. Insufficient characterization of dynamic temporal behavior; traditional methods are unable to effectively capture the time-series characteristics of complex attack patterns such as short link multi-hop redirection, script splicing, brand imitation forms, and cross-origin resource loading. 2. Over-reliance on cloud services and cloud sandbox analysis increases the risk of exposing user privacy data. At the same time, uncontrollable network latency affects user experience.

[0004] 3. The safety conclusions are uninterpretable. The detection results based on the black-box model lack an auditable chain of evidence, making it difficult to meet corporate compliance requirements and accident investigation needs.

[0005] 4. Poor engineering reproducibility and lack of standardized specifications for the data generation process and the relationship between data make it difficult to reproduce and verify the security analysis results at the engineering level.

[0006] With the improvement of computing power of terminal devices and the development of lightweight large language model technology, it has become possible to realize multimodal data fusion analysis on edge devices. However, existing technologies lack a general solution that can form a complete closed loop within the edge, that is, from data acquisition to processing and traceability, and ensure the auditability of output through a restricted decoding mechanism. Summary of the Invention

[0007] The purpose of this invention is to provide a method, apparatus, and medium for URL security analysis of a large language model on the client side, so as to solve the problems mentioned in the background art.

[0008] To solve the above-mentioned technical problems, the present invention provides the following technical solution: A URL security analysis method for a client-side large language model includes the following steps: Collect multimodal data for the target URL, including URL resolution structure and redirection chain, DNS resolution results and certificate metadata, front-end code syntax sampling information, page rendering OCR text, and dynamic behavior event sequence; Within a preset sliding time window, events in the dynamic behavior event sequence are exponentially decayed and weighted, aggregated into a dynamic feature vector, and repeated or similar events are merged. Static structural features are generated based on the URL parsing structure and redirection chain, the DNS resolution result and certificate metadata, and text semantic features are generated based on the page-rendered OCR text. Signature similarity is calculated in the local threat intelligence database based on the URL parsing structure and redirection chain, the DNS resolution result and certificate metadata, and front-end code syntax sampling information. A gated attention mechanism is used to fuse the static structural features, dynamic feature vectors, text semantic features, and signature similarity to obtain fused features; The fused features and readable context extracted from the multimodal data are input into the edge-side large language model. Under vocabulary masking and JSON template constraints, multiple security analysis tools are invoked to obtain tool inspection results. The security analysis includes certificate inspection, redirection statistics, dangerous API statistics, brand similarity inspection, and local IOC matching. The edge-side large language model outputs structured security analysis results, which include risk type identification, risk score value, minimum sufficient evidence set, and recommended actions. Based on the fusion features and the tool inspection results, a risk score is obtained through a two-stage scoring process, and the risk type, minimum sufficient evidence, and recommended actions are determined. When the risk score exceeds a preset threshold, the security policy corresponding to the recommended action is executed on the device side, and the analysis results are locally stored in an append-only, irreversible hash JSONL structure.

[0009] Preferably, during the process of collecting multimodal data for the target URL, for short URLs or URLs with a path length of no more than 3, multi-hop parsing is triggered to obtain the redirection chain, the number of parsing hops does not exceed 5, and the status code, main domain, path hash and cross-origin flag of each hop are recorded; After collecting the multimodal data, the following steps are further included: Construct a cross-modal association graph using URL hash and timestamp as a combined primary key; The association graph includes the following edge relationships: Redirect causal edges are used to connect consecutive redirection records to form a complete redirection chain; API call trigger edge, used to connect dangerous API call records in front-end code with subsequent network request events; Text interaction binding edge, used to connect OCR text fragments extracted from page rendering with the corresponding form submission event; The certificate host binding edge is used to connect the collected digital certificate records to their corresponding access target hostnames; The association graph is maintained within a preset sliding time window, and computing resources are managed through node elimination and memory optimization mechanisms.

[0010] Preferably, the step of exponentially decaying weighting of events in the collected dynamic behavior event sequence within a preset sliding time window includes the following steps: Calculate the time offset for each event, which is the absolute difference between the current reference timestamp and the event occurrence timestamp; Based on the time offset and the decay factor γ, through the exponential decay function: Calculate the temporal decay weight for each event, where, For time-series decay weights, This is the current reference timestamp. γ is the timestamp of the event, and γ is the decay factor. The time-decay weights are used to weight the feature representations of the corresponding events; All weighted event features are aggregated into a dynamic feature vector within the sliding time window; The value of the attenuation factor γ is positively correlated with the event density within the sliding time window. The higher the event density, the larger the value of γ, and the value of γ ranges from 0.03 to 0.12.

[0011] Preferably, the collection of OCR text for page rendering includes the following steps: First, extract the visible text content directly from the document object model; When a form element, input box, modal dialog box, or pop-up window interaction area is detected, bitmap rendering and cropping are performed on the corresponding display area; The cropped bitmap is processed by optical character recognition to obtain the text content; Identify personally identifiable information in text, including email addresses, phone numbers, bank card numbers, and cryptocurrency mnemonic phrases; The identified personal identification information is masked, and only the masked text content and the SHA-256 fingerprint of the original text are saved.

[0012] Preferably, the generation of the static structural features includes: Based on the URL resolution structure and redirection chain, the DNS resolution results, and certificate metadata, character-level n-gram embedding features of domain names and paths are extracted, certificate chain integrity indicators are calculated, the matching degree between the SAN list and the primary domain is verified, ASN attribution and geographic label information are obtained, and the Damerau-Levenshtein edit distance between the domain name and the pre-built brand dictionary is calculated. The generation of the text semantic features includes: encoding the OCR text rendered on the page using a pre-trained language model with quantized compression, extracting semantic feature vectors, and matching inducing intent tags based on a preset keyword library; The calculation of signature similarity includes: using a Bloom filter with a false positive rate of no more than 10^-5 for fast screening, combining a Trie tree that supports the shortest prefix matching and the longest prefix matching for accurate retrieval, and outputting the top K matching results with the highest similarity, where the value of K ranges from 3 to 10.

[0013] Preferably, the feature fusion using a gated attention mechanism includes: The static structural feature vector The dynamic feature vector The text semantic feature vector The signature similarity feature vector Φ is concatenated with the signature similarity feature vector Φ along the feature dimension to obtain the concatenated feature. ; Through the first linear transformation layer The splicing features are subjected to dimensionality reduction and nonlinear activation, and then passed through a second linear transformation layer. The mapping yields attention for each modality; The attention is normalized using the softmax function to obtain the attention weights for each modality. , , , ; The original feature vectors are weighted and summed based on the attention weights to obtain the fused feature vector: , where ⊙ represents element-wise multiplication; The formula for implementing the gated attention mechanism is as follows: Where σ is nonlinear, These are static structural feature vectors; For dynamic behavior feature vectors; This is a text semantic feature vector; For threat intelligence similarity features; This is the weight matrix for the first-level linear transformation; This is the weight matrix for the second-level linear transformation; For submodal attention weights, including , , , ; s represents the fused feature vector; s represents the static structural feature; d represents the dynamic behavioral feature; and e represents the textual semantic feature.

[0014] Preferably, the step of calling multiple security analysis tools to obtain tool inspection results also includes an exception handling mechanism: When the structured output of the terminal-side large language model fails to pass the predefined JSON Schema validation twice consecutively, a fallback process is automatically triggered. The rollback process includes: Switch to a multilayer perceptron-based machine learning scorer and a predefined rule-based scorer for risk scoring; The relevant information for this rollback event is recorded in the local log file, including the trigger time, the reason for the verification failure, and the type of rollback scorer used.

[0015] An endpoint URL security analysis device, comprising: The data collection module is used to collect multimodal data for the target URL. The multimodal data includes URL parsing structure and redirection chain, DNS resolution results and certificate metadata, front-end code syntax sampling information, page rendering OCR text, and dynamic behavior event sequences. The time window weighting module is used to perform exponential decay weighting on the dynamic behavior event sequence and aggregate it into a dynamic feature vector within a preset sliding time window; The fusion encoding module is used to generate static structural features based on URL parsing structure and redirection chain, DNS resolution results and certificate metadata, generate text semantic features based on page-rendered OCR text, calculate local threat intelligence similarity based on URL parsing structure and redirection chain, DNS resolution results and certificate metadata, and front-end code syntax sampling information, and use a gating attention mechanism to fuse these features to obtain fused features; The security reasoning module includes an edge-side large language model, which is used to call a security analysis toolset under restricted decoding control, obtain tool inspection results based on the fused features and readable context, and calculate risk scores, risk types, minimum sufficient evidence, and recommended actions. The strategy and evidence collection module is used to execute security policies based on risk scores and preset thresholds, and to save evidence in JSONL and hash chain formats. The update module is used to update and maintain the local knowledge base through federated learning or distillation.

[0016] Preferably, the edge-side large language model is a quantization model with 3B to 7B parameters, using integer 4-bit or 8-bit quantization, with a context length of 4k to 8k, the additional memory overhead of the device does not exceed 200MB, and the total CPU latency of OCR and syntax sampling is controlled within 50 milliseconds of page loading.

[0017] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described above.

[0018] Compared with the prior art, the beneficial effects achieved by the present invention are: This invention integrates multi-dimensional signals such as static URL structure, dynamic behavioral temporal features, text semantics, and threat intelligence similarity, combined with an adaptive weighted gating attention mechanism. This allows the system to accurately identify complex attack patterns that are difficult to detect using traditional methods, such as short-link multi-hop redirects, script splicing attacks, brand imitation, and social engineering, significantly reducing false negatives and false positives. By deploying a lightweight large language model and security analysis toolset on terminal devices, it achieves a closed-loop process within the device, from data collection and feature fusion to risk inference and policy execution. This not only eliminates the privacy risks associated with transmitting sensitive data to the cloud but also controls analysis latency to the millisecond level through localized processing, ensuring a smooth user experience.

[0019] By leveraging restricted decoding technology to ensure structured content output from large language models, and combining gating attention weights, tool call results, and a minimum sufficient evidence set, clear and traceable decision-making basis is provided for each security conclusion. This greatly facilitates the investigation and review of security incidents and corporate compliance audits. Standardized data generation, fingerprinting, and time-series association graph construction ensure high reproducibility of the analysis process and results across different terminal environments. Simultaneously, the system possesses adaptive energy consumption and offline working capabilities, dynamically adjusting analysis strategies based on device resource status, guaranteeing stable operation and continuous protection in diverse scenarios such as mobile terminals and edge devices. Attached Figure Description

[0020] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof.

[0021] Figure 1 This is a schematic diagram of the overall system architecture of the present invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] This paper will describe the specific implementation details of each technical step in the natural process of URL security analysis. Each step will clearly explain the technical problem to be solved, the technical means adopted, and the technical effect achieved. This section will fully disclose the specific implementation details of the present invention to ensure that those skilled in the art can implement the present invention without creative effort.

[0024] The endpoint URL security analyzer described in this invention can be deployed in various computing environments, including but not limited to: Mobile terminal: Smartphones or tablets with ARMv8 architecture, operating system of Android 11+ or iOS 15+, and memory ≥2GB.

[0025] Personal computer: desktop or laptop computer with x86-64 architecture, operating system Windows 10+ or ​​Linux (glibc ≥ 2.28), and memory ≥ 4GB.

[0026] Edge gateway: IoT gateway devices based on ARMv8 or x86-64, running OpenWrt or similar embedded Linux systems, with ≥1GB of memory.

[0027] To overcome the limitations of existing technologies that rely on a single data dimension for URL security analysis and are ill-equipped to handle complex attacks, this invention first establishes a complete edge-side multimodal data acquisition system. This system aims to comprehensively capture security-related signals from the network protocol layer, application layer, to the user interaction layer. like Figure 1 As shown, the system adopts a layered architecture, including: Acquisition layer: Responsible for real-time acquisition and preliminary processing of multimodal data.

[0028] Fusion and Inference Layer: Responsible for feature engineering, temporal modeling, multimodal fusion, and secure inference.

[0029] Policy execution layer: Executes corresponding security policies based on the risk assessment results.

[0030] Local knowledge base: stores threat intelligence, brand dictionaries, model parameters, etc.

[0031] The specific implementation of multimodal data acquisition includes: 1. URL parsing and redirection chain collection (D1) To accurately capture the complete access path of a URL and identify potential redirect attacks, this invention employs the WHATWG standard parser to perform structured processing on the target URL. Specifically, the system generates structured data containing protocol type, hostname, port number, path, query parameter hash, and fragment identifier hash. In particular, for URLs with short links or suspicious path characteristics (path length ≤ 3 path segments), the system automatically initiates a multi-hop parsing mechanism, tracking up to 5 hops, recording the status code, target host, path hash, cross-domain flag, and precise timestamp for each hop. This design effectively addresses the security threats of short-link attacks and hidden redirect paths, providing complete access chain evidence for subsequent analysis.

[0032] In practice, the WHATWG URL standard parser is used to perform structured parsing of the target URL, generating a `URLStruct` object containing the following fields: `scheme`: Protocol type, such as "https"; `host`: Hostname, such as "www.example.com"; `port`: Port number, such as 443; `path`: The path, such as " / login"; `query_hash`: The SHA-256 hash value of the query parameter; `frag_hash`: The SHA-256 hash of the fragment identifier.

[0033] For URLs suspected of being shortened (path length ≤ 3 or belonging to a known shortened domain), a multi-hop tracking mechanism is initiated, tracking up to 5 hops, and recording a `Hop` structure for each hop: `idx`: Jump index, starting from 0; `status_code`: HTTP status code, such as 301, 302; `location_host`: The target host for redirection; `location_path_hash`: The SHA-256 hash of the redirect path; `cross_origin`: Whether to cross origins, boolean value; `ts`: timestamp, millisecond precision; The tracing will terminate when an HTTP 200 status code, a 4xx / 5xx error code, a loopback redirect (the same URL is repeated) is detected, or the maximum number of hops is reached.

[0034] 2. Network and Certificate Metadata Collection (D2) To address the shortcomings of traditional methods in verifying network identity and certificate security, this invention implements deep network stack metadata collection. The system captures IPv4 / v6 addresses, TTL values, and ASN information during the DNS resolution phase; extracts SNI, ALPN, and protocol version during the TLS handshake phase; and performs complete parsing of digital certificates to obtain key information such as issuer, subject, SAN list, validity period, and serial number. Simultaneously, the system checks OCSP / CRL status and HSTS policies in real time and performs homograph detection on internationalized domain names. This comprehensive collection scheme provides a solid foundation of data support for identifying certificate forgery, domain name spoofing, and network identity deception.

[0035] In practice, DNS resolution collects A records (IPv4 addresses), AAAA records (IPv6 addresses), TTL (Time to Live), and ASN (Autonomous System Number); the TLS handshake phase collects: SNI (Server Name Indicator); ALPN (Application Layer Protocol Negotiation); TLS protocol version (1.2, 1.3, etc.).

[0036] Certificate information collection includes: `issuer`: Issuer DN (Distinguished Name); `subject`: Subject DN; `SAN[]`: List of alternative subject names; `not_before`, `not_after`: Certificate validity period; `serial`: Certificate serial number; Simultaneously, the OCSP (Online Certificate Status Protocol) and CRL (Certificate Revocation List) status are checked, the HSTS (HTTP Strict Transport Security) policy is verified, and after Punycode decoding of internationalized domain names, a homograph detection algorithm based on Unicode standardization is used to calculate the confusion score.

[0037] 3. Front-end code syntax sampling and dangerous API traces (D3) To address the technical challenges of malicious scripts evading detection, this invention implements intelligent sampling analysis of front-end code within a strict time budget (≤10ms). It employs a hybrid sampling strategy of prioritizing the first and last lines while using uniform hashing to ensure the capture of the most representative code features with a coverage rate of 10%-35%. The system accurately identifies dangerous API calls by constructing an AST (Abstract Syntax Tree), including key functions such as code execution, password manipulation, and credential management functions, and records the call location, parameter fingerprints, and pollution source information. This syntax analysis-based monitoring method effectively overcomes evasion techniques such as dynamic obfuscation and code encryption.

[0038] In practice, JavaScript code sampling is performed within a strict time budget (≤10ms): 1. Beginner and end priority: Ensure that critical code at the beginning and end of the script is captured; 2. Uniform hashing: The sampling distribution is ensured to be uniform based on the hash value of the code block; 3. Coverage control: The target is to cover 10%-35% of the script content.

[0039] Dangerous API monitoring uses AST (Abstract Syntax Tree) analysis technology to identify the following key function calls: `eval()` and `Function()`: Dynamic code execution; `crypto.subtle`: Cryptographic operation; `navigator.credentials`: Credential management; `Clipboard`: Clipboard access; `postMessage`: Cross-document communication; `fetch` and `WebSocket`: Network communication.

[0040] For each call record, the `JsCall` structure is: `api`: The name of the API being called; `loc`: Call position (row number, column number); `args_hash`: The SHA-256 hash of the parameter value; `tainted_sources[]`: Results of pollution source tracing; `ts`: Retrieves the timestamp.

[0041] 4. Page rendering and OCR text capture (D4) To identify social engineering and UI spoofing attacks while protecting user privacy, this invention designs a layered text content extraction mechanism. The system prioritizes extracting text content directly from the DOM, triggering OCR processing only for sensitive interactive areas such as forms, input boxes, and dialog boxes. During OCR processing, the system automatically detects and masks PII information, saving only the text mask and cryptographic hash. This method preserves the semantic content used for security analysis while ensuring that sensitive user information is not stored in plaintext, perfectly balancing the needs of security detection and privacy protection.

[0042] In practice, a layered text extraction strategy is adopted: DOM text priority: Directly extract visible text from the document object model; Selective OCR: Triggers OCR processing for the following areas: All <form>`Elements and their child elements; For data of type `text`, `password`, or `email` <input> `Element; Modal dialog boxes and pop-up windows; Tooltip text displayed when the mouse hovers over the cursor.

[0043] OCR processing flow: Crop the bitmap of the target area; Use a lightweight OCR engine (such as a simplified version of Tesseract) to recognize text; The identified PII (Personally Identifiable Information) is masked.

[0044] Generate `OcrFrag` records: `bbox_hash`: A hash of the region's location and size; `text_mask`: The text behind the mask; `text_hash`: The SHA-256 hash of the original text; `ts`: timestamp collected.

[0045] 5. Dynamic Behavioral Event Sequence Acquisition (D5) To characterize the risk accumulation process over time, this invention employs a lock-free circular buffer to efficiently record the entire interaction process between the user and the page. The system defines a complete event classification system covering key behaviors such as page lifecycle, navigation redirection, script execution, form interaction, and network requests. Each event includes a precise timestamp, event source, and related resource hash, providing a high-quality data foundation for subsequent time-series analysis. This design ensures that the system can capture the complete attack chain from page loading to user interaction in real time.

[0046] In practical implementation, a lock-free circular buffer is used to store the event sequence, with a capacity of K=64 or 128, supporting insertion and deletion operations with O(1) time complexity; event types include: `load`: Page loading; `redir`: redirection; `script`: Script execution; `form`: Form interaction; `xhr`: XMLHttpRequest request; `ws`: WebSocket connection; `dl`: File download; `exception`: An exceptional event.

[0047] Each event record has an `Ev` structure: `type`: Event type; `ts`: timestamp; `origin`: the source of the event; `url_hash`: The hash of the associated URL; `meta`: Event metadata (such as error messages, data size, etc.).

[0048] To ensure the reproducibility of data generation, a unified standardization and fingerprinting process is implemented: Hash algorithm: Use the SHA-256 algorithm with a fixed salt value for all paths, query parameters, script fragments, and bitmap digests; Time standardization: A unified UNIX timestamp with millisecond precision is adopted; Text normalization: Domain names and certificate body information are normalized for case sensitivity and whitespace characters are compressed; Memory mapping: The processed data is stored in read-only shared memory for low-latency access by subsequent modules.

[0049] Traditional URL security analysis methods often neglect behavioral patterns over time, resulting in insufficient detection capabilities for progressive attacks. To address this issue, this invention establishes a time-aware multimodal feature engineering framework.

[0050] To discover the inherent connections between different security events, this invention constructs a unified data association graph using URL hashes and timestamps as joint primary keys. This graph defines four core edge relationships: redirection causal edges connect consecutive jump records, forming a complete access path; API call trigger edges associate code execution with network behavior; text interaction binding edges connect interface content with user actions; and certificate host binding edges establish the correspondence between identity credentials and access targets. Through association analysis using this graph structure, the system can identify security events scattered across different modalities but with causal relationships: In practice, the construction of the data association graph includes: Construct a multimodal data association graph using `url_hash` and timestamp `ts` as a composite primary key: Edge E1: `Hop(idx) → Hop(idx+1)`, represents a redirection causal relationship; Edge E2: `JsCall → Ev(script / xhr / ws)`, represents the network behavior triggered by the API call; Edge E3: `OcrFrag → Ev(form)`, represents the binding of text content with user interaction; Edge E4: `cert → host`, indicating the binding relationship between the certificate and the host; The graph is maintained within a sliding time window (15-60 seconds), and nodes outside the window are pruned but their digest hashes are retained for traceability.

[0051] To quantify the cumulative effect of risk over time, this invention implements exponentially decaying weighted aggregation of dynamic behavioral event sequences. The system adaptively adjusts the decay factor (0.03-0.12 / s) based on event density, calculates the temporal weight of events within a sliding window of 15-60 seconds, merges high-frequency continuous events, and retains sparse anomalous events, ultimately generating a feature vector representing the dynamics of the behavior. This temporal modeling method enables the system to distinguish between normal user browsing behavior and the mechanical patterns of automated attacks.

[0052] In practice, within the sliding time window, an exponentially decaying weight function is applied to the D5 event sequence: in, For time-series decay weights, This is the current reference timestamp. The event timestamp is used, and the decay factor γ is adaptively adjusted within the range of 0.03-0.12 / s based on the event density.

[0053] Passing through similar adjacent thresholds =200 ms Merging and density threshold =1.5 s After deduplication, it is aggregated into a dynamic vector Fd.

[0054] To fully leverage the complementary value of data from different modalities, this invention constructs analytical features from three dimensions: static structural features extract inherent attributes from URLs, certificates, and network identities; textual semantic features capture the deeper meaning of interface content through a pre-trained language model; and threat intelligence similarity is calculated based on the degree of matching of known threat patterns using a local IOC library. This multi-dimensional feature design ensures that the system can simultaneously utilize structural, semantic, and intelligence signals for comprehensive judgment. Specifically, this includes: Static structural characteristics: n-gram embeddings of domain names and paths (64-256 dimensions); Certificate chain integrity metrics; SAN and primary domain compatibility; ASN and geotags; Edit distance of the domain name to the Damerau-Levenshtein dictionary of brands.

[0055] Text semantic features: Semantic features (128-384 dimensions) are extracted using quantized sentence vector models (MiniLM or SimCSE). Intent tags based on keyword matching, such as "verify account", "restore wallet", "enter mnemonic phrase", etc. Threat intelligence similarity Φ: A Bloom filter (false positive rate ≤10^-5) was used for rapid screening. Uses a Trie tree for exact matching, supporting both shortest and longest prefix matching; Output the 3-10 most similar matches.

[0056] Single-modal analysis results often contain false positives or false negatives, while traditional multimodal fusion methods lack interpretability. To address this contradiction, this invention designs a fusion mechanism based on gated attention and a reasoning framework based on restricted decoding. Specifically, it includes: To adaptively balance the contributions of different feature modalities, this invention employs a gated attention mechanism for feature fusion. Through a trainable gating parameter vector and a sigmoid activation function, the system dynamically learns the importance weights of each modality's features. Layer normalization and dropout regularization are applied during the fusion process to ensure training stability and generalization ability. Crucially, the system retains the gating coefficients of each modality as interpretable evidence, enabling security analysts to understand the decision contribution of each feature.

[0057] The formula for multimodal feature fusion using gated attention units is as follows: Where σ is nonlinear, These are static structural feature vectors; For dynamic behavior feature vectors; This is a text semantic feature vector; For threat intelligence similarity features; This is the weight matrix for the first-level linear transformation; This is the weight matrix for the second-level linear transformation; Submodal attention weights; To fuse feature vectors.

[0058] LayerNorm + 0.05–0.2 dropout prevents overfitting; this design preserves submodal contribution coefficients. For explanation and auditing purposes.

[0059] To achieve reliable secure inference on resource-constrained edge devices, this invention employs a specially optimized lightweight large language model (3-7B parameters, INT4 / INT8 quantization). Through vocabulary masking, JSON template constraints, and stopping sequence control, the model outputs strictly structured content. This constrained decoding design leverages the semantic understanding advantages of LLM while avoiding the risk of uncontrollable generated content, thus meeting the deterministic and reliable requirements of secure systems.

[0060] A lightweight large language model with 3-7 bytes of parameters is used, employing INT4 or INT8 quantization techniques, with a context length of 4k-8k tokens. Inference settings: Temperature parameter: 0 (to ensure output determinism); top-k sampling: Disabled; Thesaurus blocking: Prevents the generation of unstructured text; Stop sequence: `\nEND\n`.

[0061] The input context uses standard JSON format: json { "ver": "1.0", "ctx": { "F_s": "...", "F_d": "...", "F_t": "...", "Phi": "...", "snippets": { "ocr_topk": ["...", "..."], "js_calls": ["...", "..."] } }, "ask": ["cert_check", "redir_stats", "danger_api", "brand_sim", "ioc_match"] } ``` To address the shortcomings of purely data-driven approaches, this invention integrates traditional security analysis tools into the inference framework. The system defines five core tools: certificate checking, redirection statistics, dangerous API statistics, brand similarity analysis, and local IOC matching. The large language model intelligently invokes these tools and integrates the analysis results based on the context of fused features. This tool-enhanced inference architecture combines the advantages of both data-driven and rule-driven approaches.

[0062] The specific toolset included in this embodiment is: cert_check: Verifies the integrity of the certificate chain, the presence of the primary domain in the SAN, its validity period, revocation status, and the strength of the encryption algorithm; redir_stats: Statistics on redirection hop count, cross-source ratio, loopback detection, and distribution of abnormal status codes; danger_api: Counts the number of dangerous API calls and their parameter characteristics; brand_sim: Calculates the edit distance and visual similarity between the domain name, certificate subject, and the brand database; ioc_match: Matches domain names, URL fingerprints, certificate serial numbers, and JS fragment hashes in the local IOC library.

[0063] Considering the potential instability of large language models in edge environments, this invention designs a multi-layered fallback mechanism. When the model output fails to conform to the JSON Schema twice consecutively, the system automatically switches to a degradation analysis mode based on MLP and a rule engine, and records the fallback event. This design ensures that the system can still provide basic security protection even in extreme cases.

[0064] LLM output must conform to the predefined JSON Schema: json { "cert_check": {"san_ok": true, "expired": false, ...}, "redir_stats": {"hops": 3, "cross_origin": 2, ...}, "danger_api": {"eval": 1, "cred": 2, ...}, "brand_sim": {"dl": 2, "score": 0.81, ...}, "ioc_match": {"domain": {"hit": true, "rule": "R-1034"}, ...}, "final": {"R": "phish", "S": 0.82, "E": [...], "A": "block"} } ``` If two consecutive outputs fail to meet the schema validation, the system will automatically fall back to the MLP+ rule scorer and record this exception in the evidence collection log.

[0065] The ultimate value of security analysis lies in accurate risk assessment and timely protective actions. This invention achieves precise and auditable security protection through a two-stage scoring and evidence-driven decision-making mechanism. To balance detection accuracy and contextual adaptability, this invention employs a two-stage scoring strategy. The initial score is based on gated attention fusion features, outputting a basic risk probability through a sigmoid function. The correction score is based on tool invocation results, finely adjusted using a multilayer perceptron. The final score integrates both pieces of evidence through a configurable fusion coefficient. This design ensures the decision weight of core features while fully utilizing supplementary information from tool analysis.

[0066] In practice, Initial rating: Calculated based on the fused feature Z; Correction score: = MLP(T), calculated based on the tool call result T; Final rating: , where λ is a configurable fusion coefficient (default 0.6); Recommended thresholds for each category: phishing (θphish) = 0.65, malware (θmal) = 0.60, malicious redirects (θredir) = 0.55; For legitimate redirection scenarios such as OAuth, a deduction term of oauth_hint∈[0.05,0.15] is introduced to reduce false alarms.

[0067] To meet the auditability requirements of enterprise environments for security incidents, this invention defines a standard for constructing a minimum sufficient evidence set. The system extracts key evidence from five dimensions: rule hits, redirection patterns, text content, code behavior, and certificate security, ensuring that each security conclusion has sufficient technical basis. Evidence is stored in both digest and fingerprint formats, supporting both user understanding and easy audit traceability.

[0068] In practice, at least three key pieces of evidence should be extracted from the analysis results to form a minimum sufficient evidence set E: 1. Rule hit ID and hit path; 2. Redirect timeline hashes and cross-source counts; 3. OCR text fingerprint and intent tag; 4. Dangerous API call locations and parameter hashes; 5. Abnormal information in key certificate domains (issuer, subject, SAN).

[0069] The implementation of security analysis results requires robust action execution and evidence preservation mechanisms. This invention establishes a complete edge-side policy execution system. Based on the risk assessment results, the system executes differentiated security actions: high-risk threats are directly blocked and evidence is displayed; medium-risk threats continue to be monitored in an isolated environment; and low-risk threats prompt users to make decisions through warnings. This tiered response strategy ensures the accuracy of security protection and avoids the impact of excessive blocking on normal business operations. In practice, appropriate actions are taken based on the risk score S and the execution threshold θ: `block`: Prevents page loading and displays 1-3 key evidence summaries to the user; `isolate`: Continue rendering in the micro virtual machine sandbox to gather further evidence; `warn`: Access is allowed but requires explicit user confirmation; `report`: Generates a security audit package and submits it to the enterprise SIEM system; `ask_user`: Requests user assistance in labeling when confidence is low; All security decisions and evidence are stored in append-only JSONL format, with hash chaining technology ensuring log integrity. The system uses the AES-GCM algorithm to encrypt sensitive fields, implements access control based on device keys, and retains logs for 30 days by default, supporting compliance auditing and post-event analysis. This design satisfies forensic requirements while protecting user privacy.

[0070] Evidence information is stored in append-only, irreversible JSONL format. `Forensic{ts,url_hash,R,S,theta,rules[],timeline_hash,graph_hash,device_id_hash}` Logs use hash chaining technology to ensure integrity, support local AES-GCM encryption, and are retained for 30 days by default.

[0071] Considering the resource constraints and diverse operating environments of edge devices, this invention incorporates a comprehensive resource management and adaptive mechanism. Through model quantization, feature compression, and cache optimization, the system keeps total memory usage below 200MB. Employing parallel acquisition, pipelined processing, and hardware acceleration technologies, it ensures that P95 inference latency on mobile devices does not exceed 80ms, with an impact on page loading of less than 50ms. These optimizations enable this invention to run stably on resource-constrained edge devices; specifically, they include: The degradation strategy is activated when the device status reaches the following thresholds: Battery level <15% or temperature >45℃: OCR sampling rate is halved, and script sampling only processes the first and last blocks; Available memory <150MB: Disable microvirtual machine verification function; CPU load > 80%: Extend the sliding time window and reduce the sampling frequency; The system retains core functions while offline: Use a subset of local IOCs (signature increments from the last 7-30 days); Disable federated learning upload function; Security analysis will continue to be provided based on cache model parameters.

[0072] This invention also includes a model training and update mechanism, specifically including: Training data construction: Positive examples include: short link multi-hop inducement, brand imitation forms, script splicing attacks, malicious downloads, etc. Negative examples: genuine brand websites, legitimate OAuth redirects, CDN content distribution, etc.

[0073] Privacy Protection Training: Using the FedAvg federated learning framework, 50-500 terminals participate in a single round: Gradient clipping with L2 norm ≤ 1.0; Add differential privacy noise (standard deviation 0.01-0.05); Upload only the model gradients, not the original data.

[0074] Knowledge distillation: Maintaining model performance through cloud-to-end distillation: Teacher model: A large cloud-based model with 13-70 parameters; Student model: End-side mini-model with 3-7B parameters; The key is to maintain the ability to follow the instructions when calling tools.

[0075] This embodiment is deployed in a mobile browser plugin application scenario on an Android 14 environment using a Chrome-based WebView. Upon detecting a short link to t.co, a 4-hop parsing is triggered, revealing 3 cross-origin redirects. AST sampling captures the navigator.credentials.get call, OCR identifies the "verify account" misleading text, the gating attention fusion score is 0.78, the toolset returns a brand similarity of 0.84, and the IOC matches rule R-1034. The final score of 0.82 exceeds the phishing threshold, triggering a blocking operation and displaying 3 key pieces of evidence to the user.

[0076] In this embodiment, in an enterprise terminal EDR integration application scenario, within a Windows 11 enterprise environment, the EDR client receives de-identified data from a browser extension, detects expired certificates and eval calls, and triggers an isolation policy with a risk score of 0.78. It continues to monitor and collect evidence in a micro virtual machine and finally reports to the SIEM system in a standardized format.

[0077] In this embodiment, a lightweight version of OpenWrt is run on the edge gateway deployment scenario. It focuses on domain name dictionary and certificate checks, quickly identifies suspicious SNI requests, blocks malicious traffic at the gateway level, and synchronizes the security digest to the terminal user interface.

[0078] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus.

[0079] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.< / form>

Claims

1. A URL security analysis method for a client-side large language model, characterized in that, Includes the following steps: Collect multimodal data for the target URL, including URL resolution structure and redirection chain, DNS resolution results and certificate metadata, front-end code syntax sampling information, page rendering OCR text, and dynamic behavior event sequence; Within a preset sliding time window, events in the dynamic behavior event sequence are exponentially decayed and weighted, aggregated into a dynamic feature vector, and repeated or similar events are merged. Static structural features are generated based on the URL parsing structure and redirection chain, the DNS resolution result and certificate metadata, and text semantic features are generated based on the page-rendered OCR text. Signature similarity is calculated in the local threat intelligence database based on the URL parsing structure and redirection chain, the DNS resolution result and certificate metadata, and front-end code syntax sampling information. A gated attention mechanism is used to fuse the static structural features, dynamic feature vectors, text semantic features, and signature similarity to obtain fused features; The fused features and readable context extracted from the multimodal data are input into the edge-side large language model. Under vocabulary masking and JSON template constraints, multiple security analysis tools are invoked to obtain tool inspection results. The security analysis includes certificate inspection, redirection statistics, dangerous API statistics, brand similarity inspection, and local IOC matching. The edge-side large language model outputs structured security analysis results, which include risk type identification, risk score value, minimum sufficient evidence set, and recommended actions. Based on the fusion features and the tool inspection results, a risk score is obtained through a two-stage scoring process, and the risk type, minimum sufficient evidence, and recommended actions are determined. When the risk score exceeds a preset threshold, the security policy corresponding to the recommended action is executed on the device side, and the analysis results are locally stored in an append-only, irreversible hash JSONL structure.

2. The URL security analysis method for a client-side large language model according to claim 1, characterized in that, exist After collecting the multimodal data, the following steps are further included: Construct a cross-modal association graph using URL hash and timestamp as a combined primary key; The cross-modal correlation graph includes the following edge relationships: Redirect causal edges are used to connect consecutive redirect jump records to form a complete redirect chain; API call trigger edge, used to connect dangerous API call records in front-end code with subsequent network request events; Text interaction binding edge, used to connect OCR text fragments extracted from page rendering with the corresponding form submission event; The certificate host binding edge is used to connect the collected digital certificate records to their corresponding access target hostnames; The cross-modal association graph is maintained within a preset sliding time window, and computing resources are managed through node elimination and memory optimization mechanisms.

3. The URL security analysis method for a client-side large language model according to claim 1, characterized in that, The step of performing exponentially decay-weighted analysis on the events in the collected dynamic behavior event sequence within a preset sliding time window includes the following steps: Calculate the time offset for each event, which is the absolute difference between the current reference timestamp and the event occurrence timestamp; Based on the time offset and the decay factor γ, through the exponential decay function: Calculate the temporal decay weight for each event, where, For time-series decay weights, This is the current reference timestamp. γ is the timestamp of the event, and γ is the decay factor. The time-decay weights are used to weight the feature representations of the corresponding events; All weighted event features are aggregated into a dynamic feature vector within the sliding time window.

4. The URL security analysis method for a client-side large language model according to claim 1, characterized in that, The collection of OCR text for page rendering includes the following steps: First, extract the visible text content directly from the document object model; When a form element, input box, modal dialog box, or pop-up window interaction area is detected, bitmap rendering and cropping are performed on the corresponding display area to obtain the cropped bitmap; The cropped bitmap is processed by optical character recognition to obtain the text content; Identify personally identifiable information in text content, including email addresses, phone numbers, bank card numbers, and cryptocurrency mnemonic phrases; The identified personal identification information is masked, and only the masked text content and the SHA-256 fingerprint of the original text are saved.

5. The URL security analysis method for a client-side large language model according to claim 1, characterized in that, The generation of the static structural features includes: Based on the URL resolution structure and redirection chain, the DNS resolution results, and certificate metadata, character-level n-gram embedding features of domain names and paths are extracted, certificate chain integrity indicators are calculated, the matching degree between the SAN list and the primary domain is verified, ASN attribution and geographic label information are obtained, and the Damerau-Levenshtein edit distance between the domain name and the pre-built brand dictionary is calculated. The generation of the text semantic features includes: encoding the OCR text rendered on the page using a pre-trained language model with quantized compression, extracting semantic feature vectors, and matching inducing intent tags based on a preset keyword library; The calculation of signature similarity includes: using a Bloom filter with a false positive rate of no more than 10^-5 for fast screening, combining a Trie tree that supports the shortest prefix matching and the longest prefix matching for accurate retrieval, and outputting the top K matching results with the highest similarity.

6. The URL security analysis method for a client-side large language model according to claim 1, characterized in that, The feature fusion using a gating attention mechanism includes: The static structural feature vector The dynamic feature vector The text semantic feature vector The signature similarity feature vector Φ is concatenated with the signature similarity feature vector Φ along the feature dimension to obtain the concatenated feature. ; Through the first linear transformation layer The splicing features are subjected to dimensionality reduction and nonlinear activation, and then passed through a second linear transformation layer. The mapping yields attention for each modality; The attention is normalized using the softmax function to obtain the attention weights for each modality. , , , ; The original feature vectors are weighted and summed based on the attention weights to obtain the fused feature vector: , where ⊙ represents element-wise multiplication; The formula for implementing the gated attention mechanism is as follows: Where σ is nonlinear, These are static structural feature vectors; For dynamic behavior feature vectors; This is a text semantic feature vector; For threat intelligence similarity features; This is the weight matrix for the first-level linear transformation; This is the weight matrix for the second-level linear transformation; For submodal attention weights, including , , , ; s represents the fused feature vector; s represents the static structural feature; d represents the dynamic behavioral feature; and e represents the textual semantic feature.

7. The URL security analysis method for a client-side large language model according to claim 1, characterized in that, The step of calling multiple security analysis tools to obtain tool inspection results also includes an exception handling mechanism: When the structured output of the terminal-side large language model fails to pass the predefined JSON Schema validation twice consecutively, a fallback process is automatically triggered. The rollback process includes: Switch to a multilayer perceptron-based machine learning scorer and a predefined rule-based scorer for risk scoring; The relevant information for this rollback event is recorded in the local log file, including the trigger time, the reason for the verification failure, and the type of rollback scorer used.

8. A terminal-side URL security analysis device, characterized in that, include: The data collection module is used to collect multimodal data for the target URL. The multimodal data includes URL parsing structure and redirection chain, DNS resolution results and certificate metadata, front-end code syntax sampling information, page rendering OCR text, and dynamic behavior event sequences. The time window weighting module is used to perform exponential decay weighting on the dynamic behavior event sequence and aggregate it into a dynamic feature vector within a preset sliding time window; The fusion encoding module is used to generate static structural features based on URL parsing structure and redirection chain, DNS resolution results and certificate metadata, generate text semantic features based on page-rendered OCR text, calculate local threat intelligence similarity based on URL parsing structure and redirection chain, DNS resolution results and certificate metadata, and front-end code syntax sampling information, and use a gating attention mechanism to fuse these features to obtain fused features; The security reasoning module includes an edge-side large language model, which is used to call a security analysis toolset under restricted decoding control, obtain tool inspection results based on the fused features and readable context, and calculate risk scores, risk types, minimum sufficient evidence, and recommended actions. The strategy and evidence collection module is used to execute security policies based on risk scores and preset thresholds, and to save evidence in JSONL and hash chain formats. The update module is used to update and maintain the local knowledge base through federated learning or distillation.

9. The endpoint URL security analysis device according to claim 8, characterized in that, The terminal-side large language model is a quantization model with 3B to 7B parameters, using 4-bit or 8-bit integer quantization, with a context length of 4k to 8k. The device's additional memory overhead does not exceed 200MB, and the total CPU latency for OCR and syntax sampling is controlled within 50 milliseconds of page load.

10. A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method as described in any one of claims 1 to 7.

Images